@volter/twin-sentry 0.1.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,142 @@
+# @volter/twin-sentry
+
+A local **Sentry** twin — a faithful, stateful local Sentry error-monitoring API your real
+`@sentry/node` SDK talks to **unmodified**. Point your SDK's DSN at the twin and a normal
+`Sentry.captureException()` lands an event that the twin **groups into an issue**; browse the
+issues/events/releases through the real Web API (`/api/0/...`) or the dashboard mirror.
+Mirror real Sentry, simulate, and fork. Built on `@volter/world-core`.
+
+It is **two API families over one local event-sourced state** (the `@volter/world-core` kernel):
+
+1. **Ingestion (the SDK side)** — `POST /api/:projectId/store/` and `/api/:projectId/envelope/`,
+   authenticated by the DSN public key (`X-Sentry-Auth` / `?sentry_key=` / envelope `dsn`). The
+   twin derives a **deterministic fingerprint**, **groups** events into issues, increments
+   `count` + `firstSeen`/`lastSeen`, persists the event, and returns the event id. A new event on
+   a resolved/ignored issue **reopens** it (regression).
+2. **Web API (the dashboard side, `/api/0/...`)** — issues (list with `query`/`sort`, retrieve,
+   resolve/ignore/unresolve/assign, delete, events), events, projects + keys/DSN, releases +
+   deploys + commits, organizations + teams, and alert rules + **signed webhooks**.
+
+No real Sentry is ever contacted on the serve path — it's fully local and offline. Real vendor
+I/O happens **only in the connector**, over an **injected client** (a fake in tests, a real
+token-authed client in prod). `readOnly` rejects writes (vendor-shaped 405). An unmodeled
+operation **fails like Sentry** (4xx JSON `{ detail }`) — never a fabricated success.
+
+## Quick start
+
+```bash
+# serve the twin (ingestion + Web API); prints the DSN to point @sentry/node at
+bunx world-sentry serve --port 9000
+#   point @sentry/node at DSN: http://twinpublickey...@127.0.0.1:9000/1
+
+# the dashboard mirror (React)
+bunx world-sentry mirror --port 9001
+
+# offline shape conformance
+bunx world-sentry conformance
+```
+
+```ts
+import * as Sentry from '@sentry/node';
+Sentry.init({ dsn: 'http://twinpublickey00000000000000000000@127.0.0.1:9000/1' });
+Sentry.captureException(new Error('boom')); // → a grouped issue in the twin
+```
+
+## Coverage
+
+The honest denominator is the **capability manifest** (`src/sentry-capabilities.ts`): the real
+Sentry surface, ranked core → common → niche, where every `done` capability is proven by an
+**offline** `verify()` that drives real ingest/create → read → assert against the twin. The
+baseline test (`src/sentry-capabilities.test.ts`) asserts via `assertManifestBaseline`: total
+≥ 50, done > 0, **0 regressions**. Every capability is either `done` or `todo`.
+
+**Modeled (core → niche):**
+
+- **Ingestion** — store + envelope endpoints, DSN public-key auth (header/query/envelope),
+  message + exception events, deterministic grouping (incl. number normalization), distinct
+  grouping, regression reopen, culprit from the top in-app frame.
+- **Issues** — list (`query` DSL: `is:`, `level:`, free text; `sort=date|freq|new`), retrieve,
+  resolve/ignore/unresolve/assign, delete, events + latest event, shortId/permalink/metadata,
+  **bulk** resolve/ignore (`?query`/`?id`), **merge** groups, **tag value distributions**
+  (`/tags/`, `/tags/:key/`), **grouping hashes** (`/hashes/`), **activity feed** (`/activity/`),
+  **user feedback** (`/user-feedback/`: submit + list crash-report comments, linked to the event's issue).
+- **Events** — list, retrieve, tags/level/platform, exception stacktrace entries,
+  **attachments listing** (envelope `attachment` items → per-event metadata), **org event facets**
+  (`/events-facets/`: tag-value `topValues` distributions across the org's persisted events).
+- **Projects** — list/retrieve/create/update/delete, project **keys/DSN** (list + create +
+  toggle/revoke/**delete** + **per-key rate-limit** config), **environments** (distinct envs),
+  **ownership rules + CODEOWNERS** (path/url/module → owners, schema-parsed), **inbound data
+  filters** (browser-extensions / legacy-browsers / localhost / web-crawlers toggles), **spike
+  protection** (org-level enable/disable per project — `/spike-protections/`).
+- **Releases** — create/list/retrieve/update/delete, associate commits, **deploys**, **release
+  files / artifact registry** (source-map upload metadata), **commit files** (`/commitfiles/`:
+  files changed across a release's commits, flattened from each commit's patch set), **release
+  health** (crash-free session tallies over real persisted session envelopes — `/organizations/:org/sessions/`).
+- **Organizations + teams** — list/retrieve/create/update/delete (org), list/create (teams),
+  **org members** (invite / list / role change / remove), **team membership** add/remove,
+  **SCIM 2.0 provisioning** (Users + Groups CRUD under `/scim/v2/` with faithful SCIM
+  envelopes / ListResponse / 409-on-duplicate), **org stats** (`stats_v2` totals over real
+  events), **integrations** (GitHub/Slack/PagerDuty install + config CRUD), **custom dashboards
+  + widgets**, **Discover saved queries**.
+- **Alerts + webhooks** — issue alert rules with **actions** (email/Slack/PagerDuty/MS Teams,
+  validated per-type), **metric alert rules** (`/alert-rules/`: aggregate + dataset + thresholds
+  with critical/warning triggers), **signed** (HMAC-SHA256 `Sentry-Hook-Signature`) webhooks on
+  **new-issue** + **regression** via an **injected deliverer** (offline `verify()`).
+- **Mirror UI** — Issues stream (grouped errors: count / last-seen / level / status), Issue
+  detail (latest-event stacktrace + tags), **Dashboards** (custom widgets), **Discover** (query
+  builder scaffold + saved queries), Releases, Projects, **Alerts** (issue alert rules),
+  **Settings** (general / client keys-DSN / environments) — all backed by real twin state.
+- **Connector** — pull (issues/projects/releases) + push (issue triage: resolve/ignore/assign)
+  over an injected executor, with confirm + idempotent re-push.
+
+**Planned (`todo`) — the deeper engines Sentry runs that this twin has not built yet:**
+
+- **Symbolication** (`sentry.events.symbolication`) — de-minify stacktrace frames against uploaded
+  source maps and debug files. Raw frames and the artifact registry are already faithful.
+- **Span percentile aggregation** (`sentry.performance.span_aggregation`) — p50/p75/p95 computed
+  over the transaction and span events the twin already stores, plus the trace and time-series read
+  endpoints that serve it.
+- **Session Replay segment ingest** (`sentry.replay.segment_ingest`) — accept and persist the
+  recorded rrweb/DOM segment uploads and serve the replay list, detail and segment reads.
+- **Continuous profiling** (`sentry.performance.profiling`) — accept sampled stack-profile envelopes
+  and serve the flamegraph aggregation computed over them.
+- **Grouping enhancements** (`sentry.ingest.grouping_enhancements`) — stack-aware
+  grouping-enhancement rules, fingerprint rules and frame heuristics on top of the deterministic
+  base fingerprint (exception type + value + culprit, or message, numbers normalized), which is
+  documented and already faithful-but-simple.
+- **Cron monitors** (`sentry.crons.monitors`) — check-in endpoints plus a deterministic
+  heartbeat-miss detection engine over stored check-ins.
+
+Several config-modeled surfaces persist and round-trip their CONFIG faithfully while their live
+EXECUTION is likewise unbuilt: metric-alert threshold evaluation/firing, Discover arbitrary query
+execution (the builder and saved queries are real), and attachment binary download (the metadata
+listing is real; the bytes need a blob store). Alert-action config persists and round-trips, and no
+notification is sent. Release-health crash-free counts ARE real exact tallies over persisted
+sessions; only the time-series rollup is absent.
+
+## Architecture
+
+State and execution follow the shared [model](../../../docs/concepts/the-model.md) and
+[architecture](../../../docs/contributing/architecture.md). The kernel owns storage and execution
+mechanics; this package owns vendor semantics. Conformance tooling is a development dependency.
+The [generated index](../../../generated/INDEX.md) records this package's protocol standing.
+
+## Rate budget — the fail-closed backstop on live calls
+
+`liveSentryExecute` is the **one place** this pack issues a live request, so every call it makes is charged
+against a persistent, fail-closed spend ledger **before** the request goes out. Past the ceiling, or
+while a `Retry-After`/429 cooldown is armed, it **throws instead of calling**. The ledger is keyed by
+vendor and a hash of the credential (limits are per credential, so it is deliberately *not*
+cwd-scoped) and persists across processes, so a fresh process does not get a fresh allowance; a
+corrupt ledger counts as a **full** window rather than zero spend. There is no option to disable it,
+and no value you can pass for `budget` that yields an unguarded client — an injected budget is
+validated by *method identity*, so a subclass or a `Proxy` that replaces `checkBudget` is refused.
+
+The declared numbers: **60 weighted units / 60s at weight 2 = 30 calls/minute — exactly the kernel's austere fallback**, because Sentry publishes *no* figure at all (per-endpoint windows, unstated). What the guard buys for an unknowable limit is the **cooldown**: `X-Sentry-Rate-Limit-Remaining: 0` and `Retry-After` become a persisted client-side stop instead of a retry storm. Issue/event list reads cost 4 — the paginated firehose the docs tell you not to poll.
+
+The mechanism is **shared and vendor-agnostic** — it lives in the kernel (`@volter/world-core` →
+`packages/world-core/src/rateBudget.ts`); what lives here in [`src/sentry-budget.ts`](src/sentry-budget.ts) is this vendor's
+**declaration** (window, ceiling, per-endpoint weights, and a `reason` citing the limits above) plus
+the vendor-bound `SentryBudget`. The rule is ratified as
+[../../../docs/contributing/architecture.md](../../../docs/contributing/architecture.md) **D8**, and the kernel module's header documents what the
+guard does *not* guarantee — read that before trusting it.

package/client/sentry-mirror.css

@@ -0,0 +1,99 @@
+:root {
+  --bg: #1d1127;
+  --panel: #251a35;
+  --panel-2: #2e2140;
+  --border: #3a2d50;
+  --text: #ebe6f2;
+  --muted: #a094b3;
+  --accent: #6c5fc7;
+  --fatal: #c84b48;
+  --error: #e4774e;
+  --warning: #e2c14f;
+  --info: #5b9bd5;
+  --debug: #8a7fb0;
+  --resolved: #3aa76d;
+  --ignored: #6b5f82;
+}
+* { box-sizing: border-box; }
+body { margin: 0; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; background: var(--bg); color: var(--text); }
+.mono { font-family: "SFMono-Regular", Menlo, Consolas, monospace; }
+.app { display: flex; flex-direction: column; height: 100vh; }
+.topbar { display: flex; align-items: center; gap: 16px; padding: 0 18px; height: 52px; background: var(--panel); border-bottom: 1px solid var(--border); }
+.brand { font-weight: 700; font-size: 16px; }
+.badge { font-size: 11px; background: var(--accent); padding: 2px 6px; border-radius: 4px; vertical-align: middle; }
+.org { color: var(--muted); font-size: 13px; }
+.body { display: flex; flex: 1; min-height: 0; }
+.sidenav { width: 180px; background: var(--panel); border-right: 1px solid var(--border); padding: 12px 8px; display: flex; flex-direction: column; gap: 4px; }
+.nav-item { text-align: left; background: none; border: none; color: var(--muted); padding: 8px 12px; border-radius: 6px; cursor: pointer; font-size: 14px; }
+.nav-item:hover { background: var(--panel-2); color: var(--text); }
+.nav-item.active { background: var(--accent); color: #fff; }
+.content { flex: 1; min-width: 0; overflow: hidden; display: flex; }
+.split { display: flex; flex: 1; min-width: 0; }
+.list { width: 480px; border-right: 1px solid var(--border); overflow-y: auto; }
+.list.full { width: 100%; padding: 18px; }
+.detail { flex: 1; overflow-y: auto; padding: 22px; }
+.search-bar { padding: 12px; border-bottom: 1px solid var(--border); position: sticky; top: 0; background: var(--bg); }
+.search-input { width: 100%; padding: 8px 10px; background: var(--panel-2); border: 1px solid var(--border); border-radius: 6px; color: var(--text); font-family: monospace; }
+.issue-row { display: flex; justify-content: space-between; align-items: center; width: 100%; text-align: left; background: none; border: none; border-bottom: 1px solid var(--border); color: var(--text); padding: 12px 14px; cursor: pointer; }
+.issue-row:hover { background: var(--panel-2); }
+.issue-row.selected { background: var(--panel-2); border-left: 3px solid var(--accent); }
+.issue-title { font-weight: 600; font-size: 14px; }
+.issue-culprit { color: var(--muted); font-size: 12px; margin-top: 2px; }
+.issue-meta { display: flex; align-items: center; gap: 8px; flex-shrink: 0; }
+.issue-count, .issue-lastseen { color: var(--muted); font-size: 12px; }
+.pill { font-size: 11px; padding: 2px 7px; border-radius: 10px; text-transform: uppercase; font-weight: 600; }
+.level-fatal { background: var(--fatal); color: #fff; }
+.level-error { background: var(--error); color: #fff; }
+.level-warning { background: var(--warning); color: #1d1127; }
+.level-info { background: var(--info); color: #fff; }
+.level-debug, .level-muted { background: var(--debug); color: #fff; }
+.status-unresolved { background: #43354f; color: var(--text); }
+.status-resolved { background: var(--resolved); color: #fff; }
+.status-ignored, .status-muted { background: var(--ignored); color: #fff; }
+.detail-title { margin: 0 0 4px; font-size: 20px; }
+.detail-sub { color: var(--muted); margin-bottom: 16px; }
+.detail-stats { display: flex; gap: 26px; margin-bottom: 22px; }
+.detail-stats .stat-label { display: block; color: var(--muted); font-size: 11px; text-transform: uppercase; }
+.detail-stats .stat-value { font-size: 18px; font-weight: 600; }
+.stacktrace { background: var(--panel); border: 1px solid var(--border); border-radius: 8px; overflow: hidden; }
+.frame { display: flex; justify-content: space-between; padding: 7px 12px; border-bottom: 1px solid var(--border); font-size: 12px; }
+.frame:last-child { border-bottom: none; }
+.frame-fn { color: var(--accent); }
+.frame-file { color: var(--muted); }
+.tags { display: flex; flex-wrap: wrap; gap: 8px; }
+.tag { background: var(--panel); border: 1px solid var(--border); padding: 4px 8px; border-radius: 4px; font-size: 12px; }
+.empty { color: var(--muted); padding: 24px; text-align: center; }
+.screen-title { margin: 0 0 16px; }
+.release-row, .project-row { display: flex; gap: 18px; align-items: center; padding: 12px 14px; border-bottom: 1px solid var(--border); }
+.release-version, .project-name { font-weight: 600; min-width: 200px; }
+.release-commits, .release-date, .project-slug, .project-platform { color: var(--muted); font-size: 13px; }
+h3 { margin: 22px 0 10px; font-size: 14px; color: var(--muted); text-transform: uppercase; letter-spacing: .04em; }
+.alerts-sub { color: var(--muted); font-size: 13px; margin-bottom: 14px; }
+.alert-rule-row { display: flex; gap: 18px; align-items: center; padding: 12px 14px; border-bottom: 1px solid var(--border); }
+.alert-rule-name { font-weight: 600; min-width: 200px; }
+.alert-rule-triggers { display: flex; gap: 6px; }
+.alert-trigger { background: #43354f; color: var(--text); }
+.alert-rule-endpoints { color: var(--muted); font-size: 13px; }
+.settings-section { margin-bottom: 24px; }
+.setting-field, .dsn-row { display: flex; gap: 18px; align-items: center; padding: 8px 14px; border-bottom: 1px solid var(--border); }
+.setting-label, .dsn-name { color: var(--muted); min-width: 120px; }
+.setting-value, .dsn-public { font-weight: 500; }
+.dsn-public { color: var(--accent); font-size: 12px; }
+.env-list { display: flex; flex-wrap: wrap; gap: 8px; }
+.env-item { background: var(--panel); border: 1px solid var(--border); color: var(--text); }
+.dashboards-sub, .discover-results-note { color: var(--muted); font-size: 13px; margin-bottom: 14px; }
+.dashboard-row { padding: 14px; border-bottom: 1px solid var(--border); }
+.dashboard-title { font-weight: 600; font-size: 15px; display: block; margin-bottom: 10px; }
+.dashboard-widgets { display: flex; flex-wrap: wrap; gap: 10px; }
+.widget-card { display: flex; flex-direction: column; gap: 6px; padding: 12px 14px; min-width: 160px; background: #1c1530; border: 1px solid var(--border); border-radius: 8px; }
+.widget-title { font-weight: 500; }
+.widget-type { background: #43354f; color: var(--text); align-self: flex-start; }
+.discover-builder { display: flex; flex-direction: column; gap: 12px; padding: 14px; background: #1c1530; border: 1px solid var(--border); border-radius: 8px; margin-bottom: 14px; }
+.discover-field { display: flex; flex-direction: column; gap: 6px; }
+.discover-label { color: var(--muted); font-size: 12px; text-transform: uppercase; letter-spacing: .04em; }
+.discover-columns, .discover-query { padding: 8px 12px; border-radius: 6px; border: 1px solid var(--border); background: #120c22; color: var(--text); font: inherit; }
+.discover-columns-preview { display: flex; flex-wrap: wrap; gap: 6px; }
+.discover-column-chip { padding: 4px 8px; background: #2a2140; border-radius: 5px; font-size: 12px; }
+.saved-query-row { display: flex; gap: 18px; align-items: center; padding: 10px 14px; border-bottom: 1px solid var(--border); }
+.saved-query-name { font-weight: 600; min-width: 180px; }
+.saved-query-fields { color: var(--muted); font-size: 12px; }